In today's computing environment, corporate services behind firewalls are often made available to computing devices outside the firewalls. To have access to the corporate services, credentials, i.e. user ID and password, are often used for authentication. However, computing devices, such as mobile devices, may be easily hacked. Thus, some conventional client-cached credential systems may expose the credentials if the computing devices are compromised. Further, the stolen credentials may be used to gain access to other corporate services that accept the comprised credentials.
Some existing centralized tokenization systems may avoid caching credentials on client devices. However, these systems often require either access to a full replica of credentials or are universally trusted for multiple services making them attractive hacking targets. Thus, conventional centralized tokenization systems have high exposure issues in addition to similar issues as faced by the conventional client-cached credential systems.
For example, in a conventional centralized tokenization system, when a user via a client device requests a corporate service for the first time, the user is prompted for credentials, such as user ID and password. After providing the credentials, the credentials may be exchanged for a service authorization token with a given authorization duration and passed back to the client device. In subsequent requests, the client device may pass the token to one or more intranet services behind the corporate firewall for authentication and/or authorization. Once granted, the token cannot be revoked until it times out. Thus, similar to the compromised computing device scenario above in the client-cached credential system, a compromised token may be used to access the corporate services before its timeout. Further, similar to the client-cached system, the compromised token may enable privilege escalation in that other corporate services that accept the token from the service are at risk.